PECR and Cookie Banners: Why Most UK 'Reject All' Buttons Are Still Non-Compliant

Open the network tab in your browser, go to more or less any large UK retail, media or ticketing site, and watch what happens before you interact with the cookie banner at all. On a depressing number of sites, requests to Google Analytics, Meta's pixel, or one of a dozen ad-tech vendors have already fired by the time the banner has finished animating in. Click "reject all" a second later and, functionally, nothing changes: the trackers that mattered already got what they came for.

That single observation is worth more than most cookie-compliance checklists, because it points at the actual problem. Having a "reject all" button is not the same as being PECR-compliant. A huge share of UK sites have added the button because someone told them the regulator wants one, without touching the plumbing that determines whether it does anything.

What PECR actually requires

The Privacy and Electronic Communications (EC Directive) Regulations 2003, specifically regulation 6, is the law that governs cookies and similar technologies in the UK, not UK GDPR. Regulation 6 says you cannot store or access information on someone's device unless you've given them clear and comprehensive information about what you're doing and why, and obtained their consent, subject to a narrow set of exemptions (strictly necessary cookies, essentially).

PECR itself doesn't define "consent" in detail, so the ICO's guidance imports the UK GDPR standard: freely given, specific, informed, and an unambiguous indication by a clear affirmative action. Pre-ticked boxes don't count. Continuing to browse doesn't count. This isn't just ICO opinion dressed up as law, the Court of Justice of the EU reached the same conclusion on pre-ticked boxes in Planet49 (C-673/17) back in 2019, and the ICO has treated it as settled ever since.

On paper, then, "reject all" sitting next to "accept all" looks like job done. In practice it's the start of the assessment, not the end of it.

Failure mode one: the banner is a UI, not a gate

The most common technical failure is depressingly simple. Consent management platforms (CMPs) work by loading a small script early in the page, deferring everything else until the user makes a choice. That only works if every tracking script actually waits for the CMP's signal. In a lot of real deployments they don't: a marketing team drops a Google Tag Manager container, an agency adds a retargeting pixel directly into the template, someone wires up a heatmap tool with its own onboarding wizard, and none of it is registered with the CMP's blocking rules. The banner renders, looks perfectly compliant, and has no actual control over half the trackers on the page.

This is a bug in the ordinary engineering sense, not a legal grey area, and it's the easiest thing to check yourself: load the page with cookies cleared and the network tab open, and see what fires before you've clicked anything. If third-party requests to known ad or analytics domains appear before your click registers, the banner is decorative.

Failure mode two: unequal effort, not unequal wording

In November 2023 the ICO wrote to 53 of the UK's top 100 most-visited websites warning that their cookie banners appeared to breach PECR and UK GDPR, mostly on exactly this point: banners that nudged users toward "accept" through visual weighting or asymmetric friction. Most complied. 38 changed their banners in response, a handful more committed to changes shortly after. The ICO has said it isn't stopping there, and by 2025 had moved on to reviewing the next tier of the UK's top 1,000 sites, with an increasing amount of that screening automated. If your banner still makes reject harder to find than accept, you are exactly the kind of site this sweep is designed to catch.

Failure mode three: legitimate interest as a side door

This is the one that's genuinely interesting, because it isn't a UI bug, it's a framework problem. Most programmatic advertising on the web runs through the IAB Europe Transparency and Consent Framework (TCF), which lets vendors claim either "consent" or "legitimate interest" as their basis for a given purpose. Click "reject all" on a TCF-based banner and you generally do withdraw consent, but "legitimate interest" purposes often have their own separate opt-out toggles, sometimes defaulted to on, sometimes requiring you to click through to a secondary screen listing hundreds of vendors individually. A user who clicks the big "reject all" button reasonably assumes they've rejected all. Under many TCF implementations, they haven't.

Legitimate interest is a valid basis for some processing under UK GDPR, but it's largely beside the point for the initial act of setting a cookie: regulation 6 requires consent for storing or accessing information on the device, full stop, regardless of what legal basis a vendor later claims for processing whatever they read from it. The ICO's own position has been that legitimate interest is not an appropriate basis for non-essential cookies precisely because PECR's consent requirement sits upstream of the UK GDPR legal-basis question.

The TCF's legal footing has also been directly tested. The Belgian data protection authority fined IAB Europe over the framework in 2022, and in May 2025 the Brussels Market Court of Appeal held that the TCF's Transparency and Consent String processing lacked a valid legal basis under GDPR, while stopping short of declaring the whole framework unlawful. That's a Belgian ruling, not binding UK law, but plenty of UK sites use the same TCF stack, and it's a reasonable indicator of where a strict reading of the equivalent UK rules would land.

The new wrinkle: DUAA 2025

The picture is shifting again because of the Data (Use and Access) Act 2025, most of whose PECR changes took effect from 5 February 2026. It introduces a new exemption for genuinely low-risk uses, such as first-party analytics used solely to improve a website, and cookies that just remember display preferences, without requiring consent, provided users still get clear information and an easy way to object. It's narrower than it sounds: the moment analytics data feeds ad targeting, remarketing, or conversion modelling, which is true of most "analytics" set-ups bundled with a marketing suite, consent is still mandatory. The Act also brought PECR's maximum fines up to UK GDPR levels, £17.5 million or 4% of global turnover, so the cost of getting any of this wrong just went up substantially.

None of this changes the underlying test. A "reject all" button is a promise. Whether it's kept depends on whether every script on the page actually checks the consent state before it runs, whether the reject path takes the same number of clicks as the accept path, and whether "legitimate interest" is quietly doing the job "consent" was supposed to do. Most banners get the first thing right and fail one of the other two, which is why simply having the button has never been the bar.